Signatures

• Signature writing methodology

• • False-positive, false-negative
  • Vulnerability versus exploit
  • Goals for forensics, detection, prevention

• Examples

• • UPNP
  • Botnet detection
  • WMF